Vertex AI SDK Flaw Let Attackers Hijack Model Uploads in Two Seconds

Palo Alto Networks' Unit 42 disclosed a vulnerability in Google Cloud's Python SDK for Vertex AI that allowed attackers to intercept machine learning model uploads and swap in a malicious model within roughly two seconds. Google has already shipped a fix through its bug bounty program, and no evidence of exploitation in the wild has been found.